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Abstract 

Full-duplex (FD) communication is regarded as a key technology in future 5G 
and Internet of Things (loT) systems. In addition to high data rate constraints, 
the success of these systems depends on the ability to allow for confidentiality 
and security. Secret-key agreement from reciprocal wireless channels can be re¬ 
garded as a valuable supplement for security at the physical layer. In this work, we 
study the role of FD communication in conjunction with secret-key agreement. We 
first introduce two complementary key generation models for FD and half-duplex 
(HD) settings and compare the performance by introducing the key-reconciliation 
function. Furthermore, we study the impact of the so called probing-reconciliation 
trade-off, the role of a strong eavesdropper and analyze the system in the high SNR 
regime. We show that under certain conditions, the FD mode enforces a deteriorat¬ 
ing impact on the capabilities of the eavesdropper and offers several advantages 
in terms of secret-key rate over the conventional HD setups. Our analysis reveals 
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Education and Research (BMBF) of the Federal Republic of Germany (Forderkermzeichen 16 KIS 0030, 
Prophylaxe). 
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as an interesting insight that perfect self-interference cancellation is not necessary 
in order to obtain performance gains over the HD mode. 

1. Introduction 

The emerging deployment of devices with wireless coimectivity in large 
numbers — commonly referred to as the Internet of Things (loT) — has 
attracted significant attention in the research community In loT networks, 
multiple nodes are allowed to interact with each other over a shared medium. 
The communication between the nodes can be partitioned into two types, 
namely, HD and FD modes. In HD mode, the transmitter and the receiver of 
each node are constrained to share their resources, i.e., time or frequency More 
specifically, each node either listens to the transmission from the other nodes or 
broadcasts its own information over the network. As opposed to the HD mode, 
in the FD mode nodes can simultaneously transmit and receive information 
on the same frequency band. From a practical viewpoint, a number of works 
(see EI-lU, for instance), have recently proposed functional prototypes of 
FD systems. Due to the close proximity of the transmitter and the receiver 
antennas, simultaneous transmission and reception of information emanates a 
key issue of self-interference (SI). The characterization and cancellation of SI 
is the main challenge in the practical implementation of FD systems |j5]]. 

Due to the openness of the wireless medium, the transmission between two 
communicating parties can be overheard by other nodes in the network for 
free. The leakage of information to unintended nodes in the network may 
have serious consequences |16|]. In his seminal work, Wyner introduced a basic 
wiretap channel model 0 to study secrecy by taking the attributes of the 
physical channel into account. A wiretap channel consists of three nodes, 
two communicating users, i.e., Alice and Bob and an external Eavesdropper 
(Eve) from whom the communication needs to be protected. In [Z!], Wyner 
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characterized the secrecy capacity of this model, when the Alice-to-Bob link is 
stronger than the Alice-to-Eve link. The wiretap channel is extended to study 
a variety of multi-user settings, namely, the broadcast chaimel [8|, lU, the 
multi-access charmel IITOll . the relay-eavesdropper chaimel lUTI and the wiretap 
channel with correlated sources [12l- For a review of these and other related 
models, the interested reader may refer to KT^ and references therein. 

Alternatively, the confidential message can also be secured by the help 
of secref-key agreement I1T4B . In key agreement systems, Alice encrypts the 
message with the help of a secret key and broadcasts it over the network. 
It is assumed that the secret key is available at only the legitimate nodes. 
The legitimate user Bob knows the secret key and can easily decode the 
confidential message. The unintended node. Eve, is unaware of the secret key 
and hence is unable to decode the confidential message. From information- 
theoretic viewpoint, Ahlswede et al. IITSi , and Maurer IfT^ study the problem of 
secret-key agreement in bi-directional systems. They introduce the source-type 
model, where all users observe information from jointly random sources. By 
means of public communication, Alice and Bob utilize these sources in order 
to harness an advantage over Eve HTTl . The maximum rate at which the secret 
keys can be generated reliably, securely, and uniformly, is called as secref- 
key capacity. The source-type model study in llTSB has gained much attention 
in the research community and is extended to study a variety of channels, 
namely, rafe-limited public communication llTSll . (HI, and with Gaussian vector 
sources 112011 . Recently, these works are generalized to product sources in 11211 . 
In another related work (221, the secret-key rate of jointly Gaussian sources 
under a quantization constraint is studied. A situation where Alice can control 
the excitation of sources is considered in 112311 . 

In practice, the main challenge in key agreement protocols is how to dis¬ 
tribute the keys securely. In general, the charmel states between two legitimate 
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Fig. 1. The key agreement system model. 


users, i.e., Alice-to-Bob and Bob-to-Alice is known to be largely reciprocal, 
while the channel from both legitimate nodes to Eve is not the same. Due to the 
lack of similar observations. Eve is unable to trace back the respective chaimel 
states. Thus, Alice and Bob can utilize an advantage of common information to 
distill a secret key which can be used to secure information Il24l . Some practical 
implementations, for example in |[25]-||27l, have demonstrated the feasibility 
of this approach. Erom an information-theoretic viewpoint, the authors of ||28]1 , 
||2^ study the problem of key sharing by utilizing the leverage provided due 
to the reciprocity of wireless charmels and establish different methods for key 
generation. Building on these works, in II30II the fundamental trade-off between 
obtaining reciprocal CSI and randomness sharing is considered. In IISTl . the 
authors establish bounds on secret-key agreement in a two-way relay setting 
under active eavesdropping. As opposed to the previously mentioned results 
in which systems only operate in the HD mode to generate secret keys, in this 
work, we investigate this issue in the context of ED transmissions. 

In this work, we study a model where three nodes Alice, Bob and Eve 
are equipped with a single anteima each as shown in Eigure [1} where Alice 
and Bob interact between each other to establish a secret key that needs to 
be concealed from Eve. We assume that the Eve is a passive eavesdropper 
and only listens to the communication. The transmission protocol consists of 
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two phases. In the first phase, Alice and Bob obtain common information by 
probing and estimating the current state of their respective wireless charmels. 
In the second phase, Alice and Bob perform public communication under a 
transmission rate constraint. The public communication by Alice is designed 
as one-shot key reconciliation fUl . Recall that, in the HD scenario, the com¬ 
munication nodes need to allocate distinct time or frequency resources for 
transmission or reception. In contrast to this, the extension to FD is far from 
straightforward. The main difficulty in FD mode arises due to occurrence of SI, 
since the nodes can transmit and receive information over the same frequency 
band. 

We now summarize the main contributions of this work. We first intro¬ 
duce the key-reconciliation function that serves as a metric to measure the 
performance of both HD and FD systems. Next, we show that there exists a 
fundamental trade-off between the chaimel probing and reconciliation phases. 
We also study a special case of a strong eavesdropper, in which the Eve is 
allowed to remove the contribution of receiver noise. We provide the region 
under which the FD mode outperforms the HD mode. Finally, we also investi¬ 
gate the asymptotic behavior of this model in high signal-to-noise ratio (SNR) 
regimes. For this setup, we establish certain conditions that shed light on the 
benefit of FD over HD mode. We illustrate our results with the help of some 
numerical examples. 

This paper is structured as follows. In section [III the system models of both 
HD and FD modes are introduced. Section |III] defines the secret-key rate, 
more specifically, the key-reconciliation function necessary for the evaluation 
of the system performance. In section the main contributions of this work 
are discussed. Finally, section |V] concludes this paper by summarizing its 
contribution. 

Notation: We use following notations throughout this work. All vectors are 
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denoted by small bold-face letter x, and matrices by capital bold-face letter X. 
The operator exp denotes the exponential function. In denotes the logarithm 
with respect to base e, while log 2 is used for base 2. We denote the matrix 
transpose by (■)^, expectation with respect to a random variable x by Ex [•], 

entropy by H(-), differential entropy by h{-), Euclidean distance by IHI and 

( 

ceiling operator by [•]. The operator = allows equality of left and right operand. 
The notation N (0, In) denote a Gaussian random variable with zero-mean and 
identity covariance matrix of order N xN. 

IT System model 

We consider a key agreement model as shown in Figure [H The system 
model consists of three nodes, i.e., two legitimate nodes, Alice and Bob, and 
an eavesdropper Eve, where each node is equipped with a single antenna. 
The parameter hab is the chaimel which coimects Alice-to-Bob and hba is the 
channel which coimects Bob-to-Alice. Furthermore, these two links may not 
necessarily fully correlate with each other. The parameter hae is the charmel 
which connects Alice-to-Eve and hbe is the channel which connects Bob-to-Eve. 
We assume that all channels comply with a real-valued flat-fading model. We 
consider a block-fading environment where during one coherence block the 
channel coefficients remain constant and change to independent realizations 
in the next block. The key agreement protocol spans over n such blocks, and 
is depicted in Figure |2l We assume that all interactions between Alice-to-Bob 
and vice versa is authenticated by some means. In what follows, we elucidate 
these two phases, i.e., probing and reconciliation phase, associated with HD 
and ED modes. 

Remark 1. In our system model, we consider an Eve with only one antenna. A 
more capable Eve can, however, deploy multiple antermas in order to collect 
more observations. Subsequently, Eve can perform some information fusion to 
obtain a better estimate of the current channel state. For the sake of simplicity. 
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Channel 



Probing phase Reconciliation phase 


Fig. 2. Key agreement protocol — Channel estimation by probing and subsequent phase for key 
reconciliation by public communication. 


we restrict ourselves to single antenna configuration, and emulate a stronger 
Eve by allowing higher correlation of channel estimations to those of the 
legitimate nodes. 

A. Probing phase 

In each block, Alice and Bob interact between each other to send pilot signals 
to estimate the current realization of the chaimel. These signals are also known 
to Eve. The probing phase consists of a total of jSn blocks, 0 < jS < 1. In the 
k-th block, Alice gets one observation Xk e IR, Bob gets Ny observations in jk e 
IRNyXi, gg|.g observations in G The choice of parameters Ny 

and Nz, is selected based on the operating mode (HD or ED) of the system. 
At the end of fin blocks, the independent and identically distributed (i.i.d.) 
Gaussian multiple vector source observations at Alice, Bob and Eve, are given 
by xN, yN and respectively. 




1) HD mode 


In HD mode, Ny := 1 and '■= 2, i.e., y = y and z = (zi,Z 2 )^. The channel 

observations in each block are given by 

X = ^/^hba + Wfl, 

(la) 

y = yf^hab + nb, 

(lb) 

Zi = ^JsnT^ehae + nae, 

(Ic) 

Z2 = y/snrbe he + nye, 

(Id) 

where the channel coefficients hj, with i G {a, h] and j G {a, b, e}, 

Gaussian random variables with zero mean and unit variance. 

i 4^ j, are jointly 

The correlation 


coefficients between different random variables are given by 

E [haehbel ~ per 
E \haehba\ — paer 

E \hbe^ba\ ~ phe/ 

E \hhahab\ ~ ^pba- (2) 

The parameter 0 < 6 < 1 captures the delay penalty that consecutive measure¬ 
ments undergo in time-variant environments. This situation occurs when the 
reply of Bob to Alice's probing is already delayed further than the channel 
coherence time. The additive noise term is i.i.d. with n,y ~ At (0,1). The 
signal-to-noise ratios (SNRs) at the legitimate nodes and the links Alice-to- 
Eve, Bob-to-Eve, are denoted by snr, snrae, and snrbe, respectively. Note that 
the variances of both the chaimel and the noise variables are equal to one. 
In order to account for different scenarios, the parameters snr, snrae and snrbe 
can be chosen appropriately. 

Remark 2. The legitimate nodes probe the channel once per coherence block. 
Naturally, if the probing is repeated multiple times, the chaimel estimate is 
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improved. However, in many communication standards, probing is primarily 
realized by a known preamble once sent before the actual payload data is 
transmitted. Thus, we assume that only one charmel estimate per coherence 
block is available. 

2) FD mode 

Next, we turn our attention to the FD mode. In this mode, Ny := 1, Nz := 1; 
and, thus y = y and z = z. The charmel observations in each block are given 
by 


X = yfsmhba + ot Vsnrnifl -i- 

(3a) 

y = ^fsmhab + oc Vsnrnif, -i- Ub, 

(3b) 

z = Vsnrae hae + Vsnrfae hbe + ne, 

(3c) 


where nia and Ui^, denote the residual SI induced by simultaneous transmission 
and reception at Alice and Bob, respectively. This is due to the fact that, even 
after SI cancellation, some portion of the strong transmitter noise may still be 
present 10. The parameter a denotes the strength of the residual SI compared 
to the desired received signal, with a > 0, where a = 1 denotes the case when 
the residual SI is on the same power level as the desired signal. The statistics 
of the charmel coefficients hij hold verbatim as in the HD mode, except, that 
the penalty of consecutive measurements is no longer relevant since we have 
zero delay, i.e., E [hb^hab] = pba- 

Remark 3. The charmel observations in (l3all and (l3bll assume that the residual 
SI acts as independent noise. It is only linked to the transmitted signal by 
the power level, i.e., the second-order moment. This is an approximation, 
since the actual residual SI might still have some functional relationship to the 
transmitted signal. However, in this model, we assume that the SI cancellation 
is able to remove all parts of residual SI that depend on the transmitted signal 
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directly. 

B. Reconciliation phase 

In this phase Alice and Bob use the remaining (1 - f)n blocks to convey 
public messages. Alice delivers information on the key reconciliation by the 
message Ma G A1 = {1,.. .,2”^'^} to help Bob in key generation. We briefly 
discuss the role of the reconciliation, for details the reader may refer fo IfTTIl . 
During the probing phase, Alice and Bob obtain jSn observations from chaimel 
estimation. These observations are correlated, but may not be equal and there¬ 
fore require some alignment which can be done through public communication. 
Subsequently, at the begiimmg of the reconciliation phase, Alice quantizes its 
observation sequence and chooses a message for Bob as a function of the 
quantized sequence in the spirit of Wyner-Ziv coding with side information 
at the receiver [32]. Since the chaimel demands a rate constraint, the quality 
of quantization allows to control the required reconciliation rate. 

We now elaborate on the role of Bob. It is evident that FD capability is mean¬ 
ingful only in the context of two-way communication. However, as mentioned 
before, the reconciliation of Alice-to-Bob is a one-way transmission. In practical 
situations, the transmissions should be designed in a two-way fashion to fully 
utilize the leverage offered by FD transmission. Therefore, we assume that not 
only Bob is receiving the key reconciliation message from Alice, it is allowed 
to broadcasts a public message to another external node. We provide a simple 
example to highlight the impact of this communication. 

Example 1. Consider a setup for the 3-user key agreement system as shown in 
Figure lU This model consists of four nodes, three legitimate users Alice, Bob, 
Charlie and the eavesdropper Eve. The key agreement protocol is depicted 
in Figure |4] for the FD mode. We assume that during the probing phase, the 
user pairs Alice-Bob and Bob-Charlie probe the channel in different coherence 
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Fig. 3. Example of reconciliation for 3-user key agreement. 


Probing Phase Reconciliation Phase 


Alice <=> Bob 


Alice Bob 


Bob Charlie 

Bob Charlie 


Fig. 4. A sketch of the transmission protocol for the 3-user key agreement system. 


blocks. Therefore, the observation sequences of Alice-Bob and Bob-Charlie 
pairs are independent. In the reconciliation phase, Alice transmits the message 
Ma to Bob, and. Bob sends G A1 = {1,..., 2”^'^} to Charlie for key reconcilia¬ 
tion. As a consequence. Bob is both transmitting and receiving information at 
the same time in FD mode, or, in HD mode, by time-sharing. This argument 
can be extended to the arbitrary large independent key agreement networks. 

□ 

For the sake of simplicity, we restrict ourselves to a single setup of key agree¬ 
ment. The ingredients that remain crucial are that Bob is actively using the 
transmitter while receiving the reconciliation message from Alice. Thus, the 
Alice-to-Bob link achieves the reconciliation rate R, as 

Rr > 

n 


(4) 
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We assume that Bob has only imperfect CSI available. Thus, the communi¬ 
cation for reconciliation caimot achieve the capacity of a fasf-fading chaimel 
with perfect CSI |33l, but rather a lower bound on it. 


1) HD mode 


At Bob, the chaimel input-output relationship is given by 


J/r ^ah^r "t (5) 

where Xy ~ A/'(0,snr) is independent of hab, and n,. ~ AT (0,1). We define hab 
as the part of the channel state that the receiver estimates by minimum-mean 
squared error (MMSE) estimation. The variance of the estimation error is given 
by 


E [hgbl/rf _ 1 

E [y^] 1 -I- snr ’ 


( 6 ) 


2) FD mode 

Recall that, since Bob is transmitting and receiving at the same time, in FD 
mode the communication is subjected to self-interference, and thus Bob re¬ 
ceives 


yr = habXr + a Vsnr niy + Uy, (7) 

where x,- ~ AT (0, snr), Wj, ~ N (0,1) is the residual noise after interference 
cancellation and Uy ~ N (0,1) is independent additive white Gaussian noise. 
The receiver obtains imperfect channel knowledge by MMSE from probing 
in the same manner as in the HD case. The variance of the estimation error 
yields 

2 \ + 0 ^ snr 

1 -I- snr(l -I- a^)' 


( 8 ) 
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C. Key generation 

Following the probing and reconciliation phase, Alice computes a secret 
key Kfl G TC from the observations where % = [1,.. denotes a finite 

alphabet set and Rsk is the secret-key rate. From the public message Ma and 
the observations Bob obtains a key Kb G TC, while Eve tries to reconstruct 
the key from observations and the public message M^. The performance 
is measured by the probability of error 

limPr{K, = 0, (9) 

n—>oo 

and both strong uniformity and secrecy IlMl p. 116] 

jim [log2r2”''^^l - H [KMa, zl^”)] = 0. (10) 

For arbitrarily large n, the secret-key rate Rgk is achievable, if (|9|) and (ITOl) are 
satisfied. 

Definition 1. The secret-key rate Rgk with respect to a certain reconciliation 
rate is denoted by the key-reconciliation function Rgk (Rr)- 

III. Computation of Secret Key Rates 

In this section, we derive the secret-key rates that serve as a metric for 
performance evaluation. 

A. Reconciliation rates 

First, we provide the description to compute the reconciliation rate expres¬ 
sion for both HD and FD modes. We consider a public transmission from 
Alice to Bob during the reconciliation phase. This communication utilizes the 
leverage offered by FD capability, since the link Alice-to-Bob obtains a rate 
improvement by a factor of one-half compared to HD mode Il35l . 
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1) HD mode 

For the HD mode in Q, the reconciliation rate per block between Alice-to-Bob 
channel is given by 

R™ = ^^^^I{Xr)yr\hal,), (H) 

where the factor of one-half represenfs the resource share in HD mode. 

In what follows, we provide an upper bound on the reconciliation rate of (ITTI) . 
We can wrife 

(«) 

= [log 2 (l + hi snr)], (12) 

where (a) follows since conditioning reduces entropy. Subsequently, by plug¬ 
ging ((T^ into (fTT|l . we get 

^HD < [log^ (l + hi snr)] 

(^)l B / Pol \ 

^ — log2(l + E;,„JfiJsnr) 

= log 2 (1 + snr) =: R™, (13) 

where (b) follows from Jensen's inequality Il3^ p. 27]. 


2) FD mode 

In contrast to HD mode, with FD capabilities Bob does not need to split 
frequency or time resources. Thus, the Alice-to-Bob link is able to support 
twice the rate compared to the HD mode. The supported reconciliation rate 
per block between Alice-to-Bob chaimel is given by 

R™ = (l-|S)7(x,;y,M. (14) 


From ([Till , we get 


7(x,; yr\hab) = h{x,) - h{Xr\yr,hab)- 


(15) 
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The right-hand side term in tflSb can be bounded as 


(c) 


h{xr\yr,hab) = h{x,. - cyrly^hab) 


(d) 


< h{Xr - cyr\hab) 


{e) 1 

< 


[^oS 2 ((27ie) Var [x, - cy,|h„b])], 


(16) 


where (c) follows since adding a constant with c > 0 does not change entropy, 
(d) follows due fo the fact that conditioning reduces entropy; and, (e) follows 
because Gaussian disfribution maximizes conditional entropy for a fixed vari¬ 
ance. The quantify Var - cyrlKb^ is given by 


Var [x, - cyrlKb] 


snr 


(l + snr(cT2^ + a^)) 


(17) 


1 + snr(c72^ + a^ + hl^) 
where c is chosen by minimizing the mean-square error (MSE) when estimat¬ 
ing Xr from y,, and is 

Kb snr 


1 + snr(cT2^ + a^ + Kj 

Then, by plugging (IT7|) in (fT^ . and replacing it in (ITSll , we get 


1 

f(x„ y,|lZafc) ^ 




'1-1-2 snr -\-a snr(l -I- snr) 


Finally, the reconciliation rate for ED is given by 


R™ > 


1-^ 


[l°g2 (l + CvJllb)] 


where for convenience, we sef 


CpD 


snr(l -I- snr(l -I- a^)) 


1 + 2 snr +a snr(l -I- snr) 
We can further bound (l20ll as follows. 

1-^ 


(18) 


(19) 


( 20 ) 


( 21 ) 


R™ > 


(/) 1 - 6 

> - - 


2 [l«S 2 (l + Cfd exp (in )] 

log 2 (l + Cfd exp [in )), 


(22) 
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where (/) follows due to the fact that f{x) = log 2 (1 + ce^) is a convex func¬ 
tion ||37|| . The expectation over yields 


= J—— f in x" exp 

A/ Ki 


( 


X" 




2cr? 

\ hfii,) 


dx 


fe) 1 2,1 

= In crt -I- 

Kh 


yfln 


J^lny^exp(4)dy 


{h) 


In (7? +W(0.5) + ln2 

Kb 


err 

(0 1 

= In — - p. 


(23) 


where (g) holds due to the substitution x = O 0 , (h) follows because the integral 
can be solved in closed form I38l and is given by the Digamma function T'(x), 
and (i) follows from the Euler-Mascheroni constant y ~ 0.57721. Replacing (l23l) 
in (1221), we get 


pn 1 -jS 

log2 


0)1-^ 


1+CFD^e-^' 
1 


log2 1 + xe 


snr 


2 1-1-2 snr +a^ snr(l -I- snr ). 



(24) 


where (/) follows since 


= 1 

^ab 


^FD “ 


snr 


1 -I- snr -l- snr 


B. Secret-key rates 

We now provide the secret-key rate for the Gaussian sources with rate- 
limited public communication for key reconciliation. 
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Proposition 1. Let Alice, Bob and Eve observe a zero-mean Gaussian multiple 
vector source {x, y, z) 


y = bx + Wy, (25a) 

z = ex + Wz, (25b) 

where b G e G R^^, x ~ N {0,ol), Wy ~ AT^O, /wy) and ~ A/'(0, 
and recall that (i denotes the ratio of coherence blocks available for collecting 
reciprocal chaimel states at each node. Then, the rate region {Rsk,Rr) is the 
union of all achievable rate pairs satisfying 


^ x\u 




In,. + bb^ al 


Jm + bb^a^. 

x\u 


Rsk < 2 log2 


In, + bb^ol 

-Loe 

T]v, -t ee'^ol 

In, + bb^ol^^ 

2 ^^§2 

In. + eeTal^ 


(26a) 

(26b) 


for some > 0, where denotes the conditional covariance of x given 

a (Gaussian) random variable u. 


Proof: The proof of (l26l) follows along similar lines as in 11^ Section V] 
and is omitted for brevity. □ 

Next, we provide a useful proposition that is used to establish the results in 
this work. 


Proposition 2. There exist non-singular matrices Ay G R^y^^y, G R^^xn,^ 


which the achievable rate region (R„ R^f) defined in (I26all and (I26bl) . also holds 
for (d) and Q, respectively. 


Proof: The computation of the achievable rate region in (l26b for the model (l25l) 
depends on joint probability distributions only through marginals (x, y) and 
{x,z) IIT^ Appendix G]. Let y and z be the Gaussian random variables with 
the same second-order moments as y and z, respectively, and the same joint 
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statistics with x. In what follows, we elaborate the connection between z and 
z. Similar arguments can be used to show the relationship between y and y 
and is omitted. Let 

z := A^z = A^ex + A^w^, (27) 

where A^ G is non-singular. Since is invertible, the transformation 

AzZ provides a sufficient statistic and is information lossless. Subsequently, 
we need the same joint and second-order marginal statistics of z and z, i.e., 

= E [zx] 

= E [zx] = A^eol, (28) 

and 

S 2 = E [ 22^1 
= E [zz^] 

= A^e (cr^Azc) -I- A^A^ 

= + A^Al. (29) 

From ([29l) , we get 

AzAJ = =: (30) 

□ 

Remark 4. By construction, "E^ix have to be positive semi-definite matrices. 
However, in order to satisfy the conditions of Proposition |2l we also need to 
exclude all the cases where have at least one eigenvalue of zero. 

The next step is to compute the parameter vectors b and e. We now provide 
the computation of ||e|p. The computation of ||b|p follows analogously and is 
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omitted. Starting from ([28l) , the squared norm of the e is given by 


I Ii2 -4 T 

|e|| = 


(b) 


(^2 — ( TzxO ^ (^zx) ^ZX 

+'^~z^(^zx(oI-(tI^^-^CTzx) 


('i) -4 T 

— Oy. CTzx 


O 


— 1 y'-i_ 

-2 ^zx-^z '^zx 

^ .^2 


.-r2 _T ' 

^zx-^2: 


where {a) follows from (l30ll and {h) is due to the Woodbury identity 
(156)]. 

Following steps similar to as shown above, ||b|p is given by 


_T 

2 -2 ^yx 

= O 


^ rr2 _ V-l/T ■ 
^yx-^y ^yx 


(31) 

eq. 


(32) 


C. Key-reconciliation function 

The following proposition provides the secret-key rate as a function of 
reconciliation rate. 


Proposition 3. The key-reconciliation function is given by 


Ry 


n 1“4 ^ {\\bxf - \\ex\\^) + \\bx 

R.y(Rr) = 5 log,-- 


(33) 


Proof: We begin the proof by first considering R,. — the minimum possible 
reconciliation rate in (l26aD and define 


l|6: 




2||^l|2 




(34a) 

(34b) 


From the determinant identity 1391 eq. (24)], we know that 


In.. + bb'^olJ = 1 -I- cr: 


x\u\ 


'x\u^ 


(35) 
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Subsequently, from (l26aD , we get 


ot 




Finally, by plugging (l36ll into (I26bl) and repetitively using the determinant 
identity Il39l eq. (24)], we get (l33b . □ 

From Proposition |3|, we deduce the following property 

Property 1. The key-reconciliation function Rsk{Rr) is positive if and only if 
(i) Rr > 0, 


(ii) \\b. 


> e. 


Proof: Let Rsk{Rr) > 0, i.e., the numerator term inside log function in 
must be larger than the denominator. This implies that 




■) < \\bx 


The exponential term is always smaller or equal to one due to the non¬ 
negativity of reconciliation rate, therefore the inequality can only be fulfilled 


if \\bx 


> ev 


and Rr > 0. Conversely, assuming the conditions (i) and (ii) are 


satisfied, then one can strictly lower bound ([3^ by removing the exponential 
term, which in turn yields Rsk{Rr) >0. □ 

Next, we establish the appropriate representations for the key-reconciliation 
function for both HD and FD modes. 


1) HD mode 

For HD mode o, we denote the key-reconciliation function as P™- The 
computation of R™ follows along similar lines as in (l33l) with the specific 
choice of parameters ||e™||^, and ||6™||^. This leads to 




/ trr,\ trr, /—HD\ —HD 

( r ™) < rT {Rr =■ R,t . 


(37) 


where (a) follows due to (IT^ . Details on the computation of the parameters 
||e™||l and ||b™|f , are relegated to Appendix lA-li 
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2) FD mode 

In FD mode Q, the key-reconciliation function is denoted by R™. The com¬ 
putation of follows along similar lines as in (l33ll with the specific choice 
of parameters ||e™||^ and Subsequently, we get 

(R™) > Rf {S°) =■■ R^, (38) 


where (b) follows from (l24|) . The computation of the parameters ||e™|| , and 
, is provided in Appendix IA-21 


Remark 5. The particular structure of bounds in (1371) and (l38b provides the 

_hd 

worst-case performance gains between the FD and HD mode, i.e., - R^^. . 


IV. Main Results and Discussion 

In this section, we present our main results by comparing the performance 
of HD and FD approaches. We firsf define a metric which we refer to as im¬ 
provement ratio, that shows the performance gain of FD over HD approaches. 
Typically, the upgrade from HD to FD capability requires some extra hardware 
at transceivers Ii40| . Therefore, the improvement of FD mode over HD has to 
be quite significant in order to justify the additional expenses. 


Definition 2. The FD over HD improvement ratio t] and its lower bound t] are 
given by 


i] = 






R 


FD 




>!]:= 


—HD 


sk 


R 


—HD 

Rsk 


(39) 


where R™ ^ 0 and > R^^. . 


Figure |5] shows examples of secret-key rate and improvement ratio. We fix 
parameters to pae = pbe = Pe = 0.4, = 1, 6 = 0.97 and f = 0.5. In this 

example, we set snrae = snrbe = snr for the following reason — If the legitimate 
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nodes increase their transmit powers when they exchange pilots, then Eve 
benefits likewise in terms of snr. Therefore, if Eve has finite snrgg and snrbe, it 
is reasonable to assume that both snrae, and snrbe are proportional to snr. 
We show the ED rates (l38b for different values of n G {-10,-17,-20} dB. 
Fig- |5b] illustrates improvement ratio (l39l) versus snr for a G {-17,-20} dB. 
The Eigure |5a| shows the significance of self-interference cancellation, since 
we only achieve some improvement of ED over HD mode, if n 1. Eor 
a = -10 dB, the HD mode performs better than the ED mode. However, 
perfect cancellation is not necessary in order to justify the ED setup, and 
therefore secret-key generation in ED mode is attractive even if the methods 
for interference cancellation have low complexity. 

Remark 6. Such nodes that are equipped with ED capability can always use 
the HD mode as a fallback solution. Therefore, a node in ED mode technically 
never performs worse than a node with HD mode only and effectively achieves 
max(i^™,R™). 

A. Probing-reconciliation trade-off 

Recall from Eigure |2] that the probing and reconciliation phases are sharing 
n coherence blocks, where the parameter f captures the resource trade-off 
between the time duration of two phases. Next, we show that there exists 
an optimal f for which the secret-key rate is maximized. Erom the system 
designer viewpoint, this value is especially relevant since — except for the 
input power — all other system parameters are difficult to change. 

Property 2. Eor any 0 < jS < 1 and a reconciliation rate Rp = (1 - f})fp, where 

(i) fp is independent of f, 

(ii) \\b^f > \\e^f, 

(iii) R, > 0, 
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O 


E 

O) 

CD 

'S5' 





snr [dB] 


(a) 



(b) 

Fig. 5. Secret-key rates (a) from bounded equivalents of HD (37\ , and FD modes (38); and, (b) 
improvement ratios (39) for different values of snr at the legitimate users and snrae = snrbe = snr 
for the eavesdropper. The other parameters are set to pae = pbe = pe = 0.4, = 1, 6 = 0.97 and /I = 0.5. 


the key-reconciliation function Rsk{Rr) is strictly concave with respect to jS. 


Proof: The key-reconciliation function of (l33ll has a extreme point within 
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0<f}<l and its second derivative is given by 


d^R 


■sk 


21nfp4W+? 


|e;,|p)(l + ||6;,|p) 




^3 


n2 


< 0 . 


4''’(INP-||e.|P)-47(l + ||6,||2) 

The second derivative is negative for all jS, which proves the concavity of 
with respect to jS. □ 


Figure [6] illustrates an example of the optimal jS* as a function of snr. The 

—HD _ 

optimal jS* for HD and FD mode are obtained by maximizing (13711 and 
dSS]) with respect to jS. It can be clearly seen from Figure [^that it is more 
beneficial fo proportionally increase the number of chaimel estimates at higher 
snr. In this regime, the chaimel supports enhanced reconciliation rates at 
higher snr, and therefore the constraint of (l26aD is more relaxed. This trend can 
be observed for both HD and FD modes. The optimal fi* is linearly increasing in 
HD mode at higher snr. This implies that, there is no need of further investing 
into reconciliation, since the reconciliation rate gets unbounded with respect to 
snr. In the case of FD mode, however, the reconciliation rate is impeded by self¬ 
interference and therefore limited for high snr and accordingly, (}* approaches 
a saturation point. 


Remark 7. The proper choice of parameters like p^a or 6 might not be trivial, 
since they largely depend on the environment where the system is deployed; 
and, also on the properties of the node's transceivers. However, as many 
HD implementations (for instance UHl l have shown, the charmel reciprocity 
represented by 6pba is usually very high. Likewise, in all of our examples, we 
assume thaf 6 is close fo one. 


B. Strong eavesdropper 

The strong secrecy condition (flOll guarantees security against an Eve with 
unlimited computational power. However, in a practical system. Eve has more 
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Fig. 6. Depiction of optimal allocation of channel estimation and reconciliation resources for different 
values of the snr at the legitimate users where snrae = sriTbe = snr for the eavesdropper. The other 
parameters are chosen as = 1, 6 = 0.95, pae = pbe = Pe = 0.4 and a = -15 dB. 


options. For instance. Eve can obtain equipment that provides almost noise- 
free reception of signals. Furthermore, even a passive Eve is able to change 
the position in the environment. Thus, Eve can evoke certain channel statistics 
that are more favorable for eavesdropping. In this sub-section, we consider a 
special setting that models the worst-case scenario, where we assume that 
the receiver noise is negligible at Eve, i.e., Uae = n^e = tie := 0; and, provide 
regions under which a positive secret-key rate is achievable. For convenience, 
we define the parameter ^ := Vsiiiw/sruw, that denotes the ratio of channel 
strengths between Bob-to-Eve and Alice-to-Eve links. 

We first digress to provide a property which is useful to establish the results 
in this sub-section. 

Property 3. The key-reconciliation function Rsk{Rr) (l33b is strictly monotonically 
decreasing with respect to \\ex\\'^. 

Proof: The first derivative of RskiRf (l33ll with respect to \\ex\\^ does not yield 
extreme points as necessary condition of local extrema. After some straight- 
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forward algebra, by taking the second derivative 


d^R 


-sk 


(1 + ||6,||2) 1-4 


Rr 


Rr 


l+ 4 -T(l + 2||e,||") + || 6 ,in 1-4-7 


Rr 




(1 + l|exlP)2 


Rr 


l+4-T||e,|P + ||6,||2 1 - 4-7 


Rr 


> 0 , 


(40) 

it can be readily seen that (l40ll is positive for all ||ex|p, which yields the desired 
result. □ 

Next, we provide the regions under which the legitimate nodes experience 
the best or the worst situations. 


1) HD mode 

II I|2 

In this section, we first compute and later on provide the region under 

which positive secrecy rate is achievable. The computation of ||e™|| follows 
along similar lines as shown in Appendix lA-ll and is given by 

M HD||2 ^ _ snr(p,^, + - Ipepaepbe) _ 

{1+snr){l - p^)-snr{pi +pl^-lpep^epbeY 
According to (l30ll . the covariance matrix of Eve given the observations at Alice 


IS 


^z\x • — 


/' \ 
Ell Ei2 


L21 E22 

V 


m 


with entries 


-‘11 


snr,p 1 - 


snr 


1 + snr 


Pa 


Ei 2 = E21 = Vsnrae snrbe 

E22 = snrbe (1 - -^pL) 

\ 1 + snr / 


snr 


1 + snr 


pae pht 


which needs to satisfy the positive definite matrix condition 


itionli] 


matrix is positive definite, if all leading principal minors are positive. Let A be a w x n matrix. A 
kxk sub matrix is constructed by deleting the last n-k columns and rows from A. The leading principal 
minor of order k is the determinant of that submatrix. 
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Definition 3. For a fixed snr, the region denotes all 4-tuples (pae, Phe, pe, 5) s 
[-1,1] X [-1,1] X [-1,1] X (0, cxi) that satisf}!^ 

1 - p" - {Pac + pie - ^Paephepe) > 0. (43) 

Proof: The region in Definition |3] follows by computing the determi¬ 
nant of (j42|l . □ 


2) FD mode 

In this section, we first compute the ||e™|| and later on provide the region 
under which positive secret-key rate is achievable. The computation of 
is given by 

|2 snripae + ^Pbef 


..fd 


(44) 


" " {1 +f^ + 2fpe){l +snr{l + a^))-snripae+ ^pbeY' 

The covariance matrix (l30ll yields 

^ D c2 or \ Snripae +^pbef 

Definition 4. For fixed snr and a, the region denotes all 4-tuples {pae, pbe, pe, <^) s 
[-1,1] X [-1,1] X [-1,1] X (0, cxi) that satisfy 


(45) 


l+e^Upe 


snr 


(Pae 't' ^Phe) ^ 0. 


1 + snr(l -I- a^) 

Proof: The region defined in Definition |4] follows straightforwardly from 


(46) 


□ 


From the Definitions |3] and H] — the feasible region — is then given by 
iRz = Fi Figure [71 shows an example of the typical feasible region 
where the meshes denote the outer boundaries of the region. We now discuss 
two situations where the legitimate nodes experience best or worst secret-key 
rates. The best case occurs if Eve has minimal knowledge of the chaimel state 


^Note the parameter E, = Vsnrbe/snrae is added in order to enable the intersection to the corresponding 
region in the FD mode. 
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Fig. 7. Example of feasible region for ^ = 1 and fixed parameters a = -20 dB, snr = 10 dB. The 
arrow points to a specific 3-tuple of {pae,pbe,pe) that is referred to later in Figure l8b] 


of Bob-to-Alice link. Recall from Property |3] that the secrecy rate RskiRr) hi (l33l) 
is maximized, by minimizing the ||ex|p. The best case in terms of secret-key 
rate trivially happens with pae = pbe = 0 in both modes. In this case, since 
there is no correlation between the Alice-to-Bob and Alice-to-Eve links and 
vice versa; thus. Eve is unable to get any information about the secret key 
In addition to this, it is interesting to note that there are some other useful 
situations in which positive secret-key rates are achievable. In HD mode, a 
maximum of secret-key rate is attained if pae = Pepbe holds with fixed pe, and 
pbe, or symmetrically, if pbe = PePae holds with fixed pe, and pae- In ED mode, 
||e™|| vanishes if pae = -^pbe holds. This follows due to the fact that Eve only 
obtains the superposition of observations from Alice-to-Eve and Bob-to Eve 
links, which can nullify the overall observation at Eve. 

In contrast to the above, the worst case happens if Eve has occupied the most 
favorable condition for eavesdropping by maximizing He^lp in (l33ll . which in 
turn reduces the secret key rate. In HD mode, it can be readily shown that 
||e™|| is convex with respect to the tuple (pae, pbe), so the maximum lies at 
the boundary of the feasible region defined in Definition |3l In the case of ED 
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(a) pe = -0.9 



(b) Pe = 0.9 


Fig. 8. Improvement of FD over HD mode for parameters ^ = 1, a = -15 dB, snr = 10 dB, p^^ = 6 = 1 
and f} = 0.5, measured in bits/observation. The arrow in (b) denotes the point where the maximum value 
is achieved. The corresponding 3-tuple of {pae,Pbe,Pe) is marked by the arrow in Figure [7] 


mode, one can deduce a similar conclusion from (l4^ and Definition HI 

Figure |8] shows the impact of different choices of pe, pae, and pbe on the 


—HD 


term, i.e., the improvement of FD over HD mode. Recall that the 
parameter pe denotes the mutual correlation of channels Alice-to-Eve and Bob- 
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Fig. 9. Improvement of FD over HD mode for parameters pe = 0.2, p),c = -0.4, a = -15 dB, snr = 10 dB, 

= 6 = 1 and /3 = 0.5. 

to-Eve. It also comprises statistical correlation that is not related to the Alice- 
to-Bob link. As it can be seen from Figure |8al, the FD system offers the most 
advantage if the correlation coefficients pae and have different signs. Due to 
the superposition of observations from Alice-to-Eve and Bob-to-Eve links, for 
pH < 0 they are more likely to cancel each other. If we have p^ > 0 as depicted 
in Figure |8bl the observations are likely to add constructively, and therefore 
significant improvement of FD over HD mode is only apparent if the values 
of pae and pbe are close to zero. Figure |9] shows the impact of E, and pae on 
the difference of secret-key rates. For numerical tractability, we show it with 
fixed Pbe and pe- The maximum gain is obtained when ^ ~ 5 dB. As mentioned 
before, pae = -Epbe minimizes ||e™|| in FD mode. Again, the FD mode is most 
beneficial if the correlation coefficients pae and pbe have opposite signs. 

C. High SNR 

In this sub-section, we examine the case for arbitrarily high SNR at both the 
legitimate nodes and at the eavesdropper, where we ignore the contribution 





31 


of noise at each node. For simplicity of analysis, we assume that 

1) The eavesdropper experiences symmetric observations, i.e., pae = pbe 

2) The users are able to perfectly cancel any self-interference, i.e., n = 0. 

We now provide a proposition that shows that under which conditions the 
FD mode performs better than HD mode. 

Proposition 4. The improvement ratio i] > 0 of the FD over HD mode in the 
high SNR regime holds, if the following relations are satisfied 

2p: 


> 


■^ae 


1 + Pe 
pe < 1- 


2pi' 


(47) 

(48) 


Proof: We begin the proof as follows. In order to obtain a positive secret- 


> 


,HD 


Since 


key rate, we need to fulfill only Property [T] |(ii)[ i.e., ||b™|| 

Property [Tlf(i)] always holds because of insignificant contribution of noise. By 
appropriately computing the parameters ||b™|p and ||e™||^ along similar lines 
as shown in (l54b and (1581) from Appendix we get 

^Vba 


> 


2P 


P • 

-'ae 


The term in 


1 “ ^^Pla '^ + Pe- 2p; 
then follows by lower bounding the LHS of 


(49) 


We next bound the inequality (l48l) as follows. Recall that the improvement 


—HD 


requirement p > 0 implies that R™ > . Starting from (|37|) and (l38b , we get 


i + ||bH°|P iq|h;°|| 


1 + e 


mo 


1+ e 


,FD 


(50) 


Subsequently, by plugging 
we obtain 

1 + Pe 


> 


and (l60b from Appendixinto (l50b , 

{l + e+2peQ 


(1 - pI){1 + p, - 2pl) (1 - 6YJ [(1 + + 2pe^) - plil + e)2] ■ 


( 51 ) 
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Then dSTl) can be written as 

(1 - (1 + Pe) 


> 


(\+e+2pd) 


{i-pD {i+p,- 2pi) [( 1 +e+2p,o - pid+m ' 
Next, by lower bound the term on the LHS in ([5^ we get 

1 + Pe (1 + + 2pe<^) 


> 


1 + p, - ipi + e + 2p,^) - pi(i + • 


(52) 


(53) 


Finally, by rearranging (l53b with respect to pe, we get (1^ . Note that for the 


special cases ^ = 1 and pae = 0, is always fulfilled. 


—HD 


□ 


Remark 8. The condition (j47)l ensures that some advantage of the legitimate 
users over the eavesdropper exists. Without self-interference and delay penalty, 
i.e., a = 0 and 6 = 1, FD almost always performs better than HD mode, which 
has already been observed in the literature ll30B . 


V. Summary 

In this work, we studied a secret-key generation setup for reciprocal wireless 
channels for nodes with half-duplex (HD) and full-duplex (FD) capabilities. 
We first developed a system model that captured the channel probing as well 
as the public communication overhead required for key reconciliation. Next, 
we established a key-reconciliation function that is used as a metric for com¬ 
parison between HD and FD modes. The analysis revealed the improvements 
in secret-key rate in FD mode over the HD mode even under the impact of 
self-interference. We analyzed the probing-reconciliation trade-off, which holds 
an optimal solution in both modes. In the case of a strong eavesdropper, we 
identified certain situations of channel statistics that are either most favorable 
or detrimental for the legitimate users. At the high SNR regime, we established 
a sufficient condition that guarantees superior performance of the FD over 
the HD mode. From a system designer viewpoint, the results provide insight 
under which the FD can give certain gains over the conventional HD mode. 






33 


Appendix A 

Key Computation Parameters in (l37t and 

We now provide the computation of parameters which are required to estab¬ 
lish the key computations functions for HD and FD modes in sub-sections ITTT-C1 1 
and IIII-C21 respectively. Let a\ := E [x^], Uy := E [y^], Oyx '■= E [xy] and := 
E[y^|x]. The results are obtained under the condition that and cr“^ 

exist in both modes. 


1) HD mode 


In HD mode the parameters cr^, a'i and Oyx are given by 


= 1 + snr. 


Oyx ~ snr dpha- 

Next we compute the parameters ||&™|| and ||e™|| as follows. Starting from 
and (l34aD , we get 


■HD 


Ox ~ ^yxOy 


snr^ 5^ 


(1 -I- snr)2 - snr^ 6^p 


(54) 


ba 


Similarly, we can compute the parameters ||e™|| as follows. From (ISTll and (I34bll , 
we get 


.HD 


O^zx^z O^zx 
Ox O^zx^z O^zx 


(55) 


where 


/ \ 
1 -I- snrae ysnrae SnrbePe 

Vsnrae snrbePe 1 -t snrbe 


Vsnr 


^/sm^pae 

"^SnrbePfee 


(56) 


(57) 
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Then plugging in the values of (1561) and ([57t in (l55b we get 
12 NhD 


,hd 


_ ('SS) 

" "" " (1 + snr) [(1 + snrae)(l + snrbe) - snraeSnrbePe] - Nhd' 

where Nhd := snr(l+snrbe) snrae p^g+snr(l+snrae) snrbe pi-2 snrae snrbe snr paepbepe 


2) FD mode 


In FD mode the parameters al, al and Oyx are given by 


ol = ol = \ + snr(l + a^), 


oyx ~ snr6pj,fl. 

Next, we compute the parameters and ||e™||^ as follows. Sfarttng from 

and (l34aD , we get 


rPD 


snrVL 


(59) 


(1 + snr(l + a^)Y - snr^ p^^ 

II ||2 

Similarly, we can compute the parameters e™ as follows. From (ISTll and (I34bll . 
we get 


,FD 


Nfd 


(60) 


'' ^ " [1 + snr(l + (1 + snrae + snrbe+2 ysrir^7sfi?tePe) - Nfd^ 

where Nfd = snr( yjsmaepae + VsnrbePfoe)^, = 1 + snrae + snrbe +2 ysnrae snrbep, 
and (Txx = Vsnrsnr^pae + ysnrsnrbep^. 
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